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DETAILED ACTION 

Applicant's election with traverse of the invention of group I (claims 1-6, 14-30, 
and 38-49) in the reply filed on 10/17/2005 is acknowledged. The traversal is on the 
ground(s) that the search for one group would substantially overlap the search for the 
other group. This is not found persuasive because while the searches may be 
overlapping, there is no reason to believe the searches would be coextensive. A search 
for the invention of group I would be conducted substantially in class 713, subclass 156, 
while a search for group II would be primarily in class 709, subclass 237. Further, group 
II is concerned with the use of SSL handshaking and certificate chain for certificate 
delivery and validation while group I is not concerned with SSL handshaking and 
certificate chain, thus would require a different search strategy than that used for group 
II. Because the two groups are classified in different classes and would require differing 
search strategies, the examiner respectfully submits that the restriction requirement was 
proper and should be maintained as a search for both groups would place an 
unreasonable administrative burden on the part of the examiner. 

The requirement is still deemed proper and is therefore made FINAL. 

Claims 7-13 and 31-37 are withdrawn from further consideration pursuant to 37 
CFR 1.142(b), as being drawn to a nonelected invention, there being no allowable 
generic or linking claim. Applicant timely traversed the restriction (election) requirement 
in the reply filed on 10/17/2005. Claims 1-6, 14-30, and 38-49 have been examined. 

Priority 
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The current application is filed as a continuation in part of 09/330,274 filed in 
6/11/1999, now abandoned. However, note 37 CFR 1.53(d)4 which sets forth a 
necessary requirement for properly claiming priority for continuation in part applications: 
An application filed under this paragraph may be filed by fewer than all the inventors 
named in the prior application, provided that the request for an application under this 
paragraph when filed is accompanied by a statement requesting deletion of the name or 
names of the person or persons who are not inventors of the invention being claimed in 
the new application. No person may be named as an inventor in an application filed 
under this paragraph who was not named as an inventor in the prior application on the 
date the application under this paragraph was filed, except by way of correction of 
inventorship under § 1.48. 

The sole inventor of the '274 application as listed in the oath of the '274 
application was Luis Valente, while the inventor of the current application is Sihai Xiao. 
As there is no common inventor for both applications, the effective filing date of the 
current application is the actual filing date, 1/25/2002. Applicant is urged to double 
check to make sure that applicant did not mean to claim priority to a different application 
instead. 

Oath/Declaration 

The oath is objected to because claim to priority is made to application number 
09/330,274. As explained above, for the current application to properly claim 
continuation in part priority to another application, there must be at least one common 
inventor between the two applications. 
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Information Disclosure Statement 

Applicant's IDS has been considered. 

Claim Objections 

Claims 17 and 41 objected to because of the following informalities: 

1. The comma in line 2 of claim 17 should be deleted. 

2. The comma in line 2 of claim 41 should be deleted. 

3. Appropriate correction is required. 

Specification 

The abstract of the disclosure is objected to because the abstract is two 
paragraphs long. An abstract is generally limited to one paragraph within the range 
from 50-150 words. Correction is required. See MPEP § 608.01(b). 

The disclosure is objected to because it contains an embedded hyperlink and/or 
other form of browser-executable code. Applicant is required to delete the embedded 
hyperlink and/or other form of browser-executable code. See MPEP § 608.01 . 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 
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Claims 1-5, 14-24, 27-30, and 46-48 are rejected under 35 U.S.C. 112, second 
paragraph, as being indefinite for failing to particularly point out and distinctly claim the 
subject matter which applicant regards as the invention. 

1 . Claim 1 recites "providing as part of said TIO a has value of a trust entity 
certificate and associated trust information indicating a level of trust for a trusted 
entity associated with said trust entity certificate". This limitation makes no 
sense. Applicant is urged to double check the wording of the limitation as well as 
make sure there are no missing punctuations that would make the limitation 
comprehensible. 

2. Claim 4 lacks a transition word or phrase before "said". 

3. In claims 5 and 29, it is unclear what CA in line 2 stands for as applicant has yet 
to define what the abbreviation stands for. 

4. In claim 14, it is unclear what is associated with the trust information, see line 5. 

5. In claim 15, line 3 recites "said certificate", which lacks antecedent basis. The 
examiner assumes applicant meant "said signing certificate". 

6. Claim 15 recites "sending a TIO including a signing certificate to said client". 
This limitation makes no sense as recited. The examiner suspects applicant 
meant "sending a TIO which includes a signing certificate..." or "sending a TIO, 
including a signing certificate, to said client" 

7. As per claim 20, it is unclear why a provider would use secure channel to send a 
TIO to a client before using the broadcast channel. The limitation as recited 
seems to imply that the TIO is sent twice, once via a secure channel and once 
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via a broadcast channel. The examiner suspects applicant meant to recite that 
an initial TIO is sent to the client via a secure channel before using the broadcast 
channel. 

8. As per claim 22, it is unclear what is associated with trust information, see lines 
5-6. 

9. Claim 23 recites "said trust information" in line 1 , which lacks antecedent basis. 
The examiner assumes applicant meant "said associated trust information". 

10. CIaims 27, 29, and 30 recites "The apparatus of Claim 1" in their preamble. 
However, claim 1 is a method claim, so the examiner assumes in place of 
"apparatus", applicant meant "method". 

1 1 . Claim 28 recites "The apparatus of Claim 21 " in its preamble. However, claim 21 
is a method claim, so the examiner assumes in place of "apparatus", applicant 
meant "method". 

12. Claims 28-30 lacks a transition word or phrase before "said" in line 1 of each 
claims respectively. 

13. As per claim 46, the limitation "providing within said TIO hash value of a trust 
entity certificate and associated trust information" makes no sense. It is unclear 
what is provided. 

14. Any claims not specifically addressed are rejected by virtue of dependency. 

Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 
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Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 1, 2-6, 27, 29-30, 14-17, 19-21, 28, 22-26, and 38-49 are rejected under 
35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. 

1 . Claim 1 is directed towards a method which lacks any sort of concrete, useful, 
and tangible result, therefore is non-statutory. Claims 2-6, 27, and 29-30 are 
dependent on claim 1 and also do not recite any concrete, useful, and tangible 
result, thus are also non-statutory. 

2. Claim 14 is directed towards a method which lacks any sort of concrete, useful, 
and tangible result, therefore is non-statutory. Claims 15-17, 19-21, and 28, 
which are dependent on claim 14, also do not recite any concrete, useful, and 
tangible result. Note that claim 18, which is also dependent on claim 14, is 
statutory because it recites a concrete, useful, and tangible result, i.e. the TIO 
proves that it was not tampered with. 

3. In claim 22, applicant recites an apparatus comprising a trust information object, 
which is disclosed in applicant's specification as a data structure, i.e. a table of 
two columns (p13). A data structure is functional descriptive material and claims 
to any type of descriptive materials per se are not statutory. Claims 23 and 24, 
which are dependent on claim 22, merely further defines the descriptive material 
of claim 22 and are also not statutory. Note that when functional descriptive 
material is recorded on some computer-readable storage medium, it becomes 
structurally and functionally interrelated to the medium and will be statutory in 
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most cases since the use of technology permits the function of the descriptive 
material to be realized. 

4. Claims 25-26 contains a similar problem as claims 22-24 because the apparatus 
being claimed are descriptive material per se and are not statutory. 

5. Claim 38 recites an apparatus which is implemented via software alone. 
Software alone is not statutory because it lacks any sort of structure for it to 
realize functionality. The apparatus comprises a trust information object, which is 
descriptive material per se and do not define any structure for the claimed 
apparatus. The apparatus also comprises a means associated with said client 
for connecting to said server to determine whether a new TIO is available and 
means associated with said server for sending a new TIO to said client if there is 
more recent TIO. The examiner was unable to find in the specification anywhere 
in which either means were defined, so the examiner is unable to associate any 
hardware structure with either means. The 101 problem in this claim can be 
overcome by reciting hardware structure for the apparatus which would enable 
the software to realize functionality. 

6. Claims 39-45 merely further define the software apparatus of claim 38. However, 
the claims still do not recite any structure which would make the claims statutory. 

7. Claim 46 is directed towards a method which lacks any sort of concrete, useful, 
and tangible result, therefore is non-statutory. Claims 47-48 are dependent on 
claim 48 and also do not recite any concrete, useful, and tangible result, thus are 
also non-statutory. 



Application/Control Number: 10/057,066 Page 9 

Art Unit: 2135 

8. Claim 49 is directed towards a method which lacks any sort of concrete, useful, 
and tangible result, therefore is non-statutory. 

Claim Rejections - 35 USC § 103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1-3, 27, 4, 6, 30, 23-26, and 47-49 are rejected under 35 U.S.C. 103(a) 

as being unpatentable over Samar (US 6,304,974) in view of Vogel et al (US 6,816,900) 

and further in view of Fischer (US 4,868,877). 

Claim 1: 

Samar discloses the limitations of providing a trust information object (TIO) to 
said client (col 5, lines 19-61). Note that TIO is a broad term and can read on the wallet 
disclosed by Samar (Fig 2), directory service (Fig 1, item 110), digital certificates, 
signatures, or anything else that provides trust information. 

Samar does not explicitly disclose providing as part of said TIO a hash value of a 
trust entity certificate and associated trust information indicating a level of trust for a 
trusted entity associated with said trust entity certificate. However, Vogel discloses 
providing as part of said TIO a hash value of a trust entity certificate and associated 
trust information (col 2, lines 27-37) and Fischer discloses indicating a level of trust for a 
trusted entity associated with said trust entity certificate (col 4, lines 24-37; col 4, line 
34-col 5, line 8; and Fig 5, item 116). 
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At the time applicant's invention was made, it would have been obvious to one of 
ordinary skill to incorporate Vogel and Fischer's teachings within Samar's invention 
according to the limitation recited in claim 1 . One of ordinary skill would have been 
motivated to incorporate Vogel's teachings because the use of hashes would allow for 
an easy way to organize certificates listed in Samar's TIO, i.e. the wallet or directory 
service. Note Vogel disclosed that the hash values in the certificate list are used to 
verify the integrity of the certificates and to indicate which are to be removed or modified 
(col 2, lines 48-52). One of ordinary skill would have incorporated Fisher's teachings by 
indicating a level of trust for a trusted entity associated with said trust entity certificate. 
One of ordinary skill would have been motivated to do so because it is common in the 
art of computing to not only define whether something should be trusted, but just how 
much it should be trusted. This is the reason, for example, that there are multiple types 
of user accounts available for an operating system, i.e. administrators, power users, 
regular users, restricted users, etc. 
Claim 2: 

Samar further discloses wherein said TIO comprises any of: a trusted entity's 
certificate; a trust vector of said trusted entity's certificate; a value indicating a number of 
signatures required for a next update; a date said TIO is created; and a digital signature 
of all data including said certificate, trust vector, number of signatures, and timestamp, 
contained in said TIO (Fig 2). 
Claims 3 and 27: 
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The limitation of wherein said hash value is determined using any of MD5 and 
SHA-1 is obvious to Samar's modified invention as it is disclosed by Vogel (col 7, lines 
45-63). 
Claim 4: 

The limitation of said TIO conforming to the PKCS#7 standard is obvious to 
Samar's modified invention as Vogel discloses the PKCS#7 standard being used to sign 
messages (col 7, lines 37-44). It would have been obvious to have the TIO in Samar's 
modified invention conform to the PKCS#7 standard because the PKCS#7 standard 
offers a high level of security. 
Claims 6 and 30: 

Samar does not explicitly disclose saving a copy of said TIO in a persistent 
memory during said client's build time. However, the examiner asserts that it was well 
known in the art to save a copy of a TIO in a persistent memory during said client's build 
time, i.e. certificates, passwords, or keys are often assigned to a client when the client is 
built and saved in static memory to prevent the information from being lost when the 
client loses power. 

At the time applicant's invention was made, it would have been obvious to further 
modify Samar's invention such that a copy of the TIO was saved in a persistent memory 
during said client's build time. One of ordinary skill would have been motivated to do so 
because it was common to assign trust information to a client during build time and to 
save it in persistent memory to prevent lost of the information due to power failure. 
Claim 23: 
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Samar does not disclose wherein said trust information indicates a level of trust 
for a trusted entity associated with said TIO. However, Fischer discloses trust 
information indicating a level of trust for a trusted entity associated with said trust entity 
certificate (col 4, lines 24-37; col 4, line 34-col 5, line 8; and Fig 5, item 116). 

At the time applicant's invention was made, it would have been obvious to one of 
ordinary skill in the art to further modify Samar's invention according to the limitation 
recited in claim 23 using Fischer's teachings. One of ordinary skill would have been 
motivated to incorporate Fischer's teachings for the same reasons given in claim 1. 
Claim 24: 

Samar further discloses said TIO comprising any of: a time stamp which 
indicates a date that said TIO is generated; a trust attribute that comprises trust 
information associated with an entity represented by its certificate; and a thumb print 
comprising a hash of a public key embedded in a certificate that represents a trusted 
entity (Fig 2). 
Claim 25: 

Claim 25 recites limitations substantially similar to what is recited in claim 1. The 
main difference between the two claims are that claim 25 is directed towards an 
apparatus which implements the method of claim 1 . Claim 25 is rejected for the same 
reasons given in claim 1 . 
Claim 26: 

Claim 26 recites limitations substantially similar to what is recited in claim 2 and 
is rejected for the same reasons. 
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Claims 47-48: 

Claims 47 and 48 recite limitation substantially similar to what are recited in 
claims 23 and 24 respectively and are rejected for the same reasons given in claims 23 
and 24 respectively. 
Claim 49: 

Samar discloses providing a trust information object (TIO) to said client (col 5, 
lines 19-61). 

Samar does not disclose providing as part of said TIO a hash value of a public 
key embedded in a certificate that represents a trusted entity. However, Vogel 
discloses a hash value of a trust entity certificate (col 2, lines 27-37). Fischer discloses 
a public key embedded in certificate that represents a trusted entity (Fig 5). 

At the time applicant's invention was made, it would have been obvious to one of 
ordinary skill in the art to modify Samar's invention according to the limitations recited in 
claim 49 in light of Vogel and Fischer's teachings. One of ordinary skill would have 
been motivated to incorporate Vogel and Fischer's teachings for the same reasons 
given in claim 1 . Note that it would have been obvious to provide a hash value of the 
public key because it would provide a way to verify that the public key belonged to the 
proper entity. 
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Claims 5 and 29 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Samar (US 6,304,974) in view of Vogel et al (US 6,816,900) and Fischer (US 
4,868,877) and further in view of applicant's admittance of prior art. 
Claims 5 and 29: 

Samar does not explicitly hard coding a TIO derived from a set of popular CA 
certificates into said client's software. However, applicant discloses that at the time 
applicant's invention was made, it was a common approach in the art to hard code a 
TIO into a client's software (p2, lines 4-6). Further, the examiner asserts that it was also 
well known in the art to derive a TIO from a set of popular root CA certificates. This was 
disclosed by Vogel (col 4, lines 5-37), thus is obvious to Samar's modified invention. 

At the time applicant's invention was made, it would have been obvious to one of 
ordinary skill to further modify Samar's invention by hard coding a TIO derived from a 
set of popular CA certificates into said client's software. One of ordinary skill would 
have been motivated to hard code a TIO into a client's software because as applicant 
discloses in the specification, it was a common approach in the art to provide 
associated trust information (p2, lines 4-6). 

Claims 14-21, 28, 22, and 38-46 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Samar (US 6,304,974) in view of Vogel et al (US 6,816,900). 
Claim 14: 

Samar discloses the limitations of: 
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1. Embedding a trust information object (TIO) within said client (col 5, lines 19-61 
and col 6, lines 27-35). 

2. Said client connecting to said server to determine whether a new TIO is available 
(col 8, lines 26-39). 

3. Said server sending a new TIO to said client if there is a more recent TIO (col 8, 
lines 39-44). 

Samar does not disclose said TIO comprising a hash value of a trust entity 
certificate and associated trust information. However, Vogel discloses this limitation (col 
2, lines 27-37). At the time applicant's invention was made, it would have been obvious 
to one of ordinary skill in the art to modify Samar's invention using Vogel's teachings 
according to the limitations recited in claim 14. One of ordinary skill would have been 
motivated to incorporate Vogel's teachings for the same reasons given in claim 1. 
Claim 15: 

Samar further discloses sending a TIO including a signing certificate to said 
client, wherein trust information of said signing certificate indicates that said certificate 
can be trusted for signing said TIO (col 4, lines 31-42). 
Claim 16: 

Samar further discloses wherein said client fetches said TIO from a trusted 
server, said client ensuring that a root certificate that signed said signing certificate is 
contained in said TIO (Fig 5). 
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Samar does not disclose said root certificate is not revocable. However, the 
examiner asserts that non-revocable certificates were well known in the art at the time 
applicant's invention was made. It would have been obvious to one of ordinary skill in 
the art to modify Samar's invention such that the root certificate was not revocable 
because it would indicate a high level of trust for the user of the root certificate. 
Claim 17: 

Samar further discloses wherein said client verifies a digital signature of said TIO 
with a signing certificate, along with a TIO sent to said client (col 5, lines 46-51 and col 
7, lines 17-23). 
Claim 18: 

Samar does not explicitly disclose wherein multiple signatures are verified, 
depending on the number of signatures specified in said TIO; wherein said client 
hashes said signing certificates one by one; and wherein if proper results are found in 
said TIO and said certificates are trusted for signing said TIO, then said TIO proves that 
it was not tampered with. 

However, Vogel discloses wherein multiple signatures are verified, depending on 
the number of signatures specified in a TIO (col 8, lines 9-17). Vogel also does not 
explicitly disclose wherein if proper results are found in said TIO and said certificates 
are trusted for signing said TIO, then said TIO proves that it was not tampered with. 
However, the purposes of signatures are to verify and validate. If proper results are 
found for the signatures, then by definition, the TIO has proven that it was not tampered 
with. 
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It would have been obvious to one of ordinary skill to modify Samar's invention 
according to the limitation recited in claim 18 in light of Vogel's teachings because it 
would allow one to determine which signatures and certificates stored in the TIO needs 
to be replaced due to possible security breaches. 
Claim 19: 

Samar does not explicitly disclose wherein said signing certificates exist in said 
TIO in said client before said TIO is signed. However, the purpose of signing is to 
validate an object. It is well known that a certificate authority would not casually sign an 
object if it did not verify the object first. If it did so, then anything signed by the 
certificate authority would not be trustworthy as anyone familiar with the CA would 
understand that the CA has a habit of not verifying before signing. Thus to truly validate 
the TIO by signing it, the signing certificate must exist in said TIO in said client before 
the CA signs it. At the time applicant's invention was made, it would have been obvious 
to one of ordinary skill to further modify Samar's invention according to the limitations 
recited in claim 19 because it would provide for trustworthy validation. 
Claim 20: 

Samar does not disclose wherein said TIO is delivered to said client via a 
broadcast channel; wherein a provider delivers a TIO to said client that contains a 
signing certificate and associated trust information by either of including said signing 
certificate in an initial TIO saved in a client persistent memory, or by sending said TIO to 
said client through a secure channel before using said broadcast channel. 
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However, the examiner asserts that the limitation is well known in the art. In 
cable television networks, for example, a TIO is sent to clients via a broadcast channel. 
This allows clients to decrypt and descramble premium channels if they have paid for it. 
Because a broadcast channel is used, to prevent unauthorized clients from receiving 
the TIO to descramble premium channels, an authorized client is usually given a set top 
box with a certificate or identifier associated with the set top box which identifies the 
client as authorized to receive the TIO allowing the descrambling of the premium 
channels. The set top box and/or the certificate/identifier itself a TIO and was delivered 
to the client via a secure channel, i.e. the client had to pick it up from the provider's 
office or a provider's employee delivered it. The examiner submits that this practice in 
the cable broadcast industry reads on the limitation recited in claim 20. 

At the time applicant's invention was made, it would have been obvious to one of 
ordinary skill to incorporate this teaching from the cable broadcast industry in Samar's 
invention because sending a TIO via a broadcast channel is the quickest and cheapest 
way of distributing the same information to a large group of clients. One of ordinary skill 
would have been motivated to deliver a TIO to the client via a secure channel before 
using a broadcast channel as this would initially ensure that only authorized clients 
received subsequent TIO's. 
Claim 21: 

Samar does not disclose updating said TIO on a per session basis when said 
TIO is not persistently stored. However, this limitation is well known in the art of cable 
broadcasting. The TIO used to descramble certain premium shows, i.e. pay-per-view, 
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shows are not stored persistently and must be updated on a per session basis. At the 
time applicant's invention was made, it would have been obvious to one of ordinary skill 
in the art to modify Samar's invention using this teaching from the cable broadcast 
industry because it would allow for subscription usage of TIO's. 
Claim 28: 

The limitation recited in claim 28 is similar to what is recited in claim 4 and is 
rejected for the same reasons. 
Claim 22: 

Samar discloses the limitation of a trust information object (TIO) associated with 
said client (col 5, lines 19-61). 

Samar does not disclose said TIO comprising a hash value of a trust entity 
certificate and associated trust information. However, Vogel discloses the limitation (col 
2, lines 27-37). At the time applicant's invention was made, it would have been obvious 
to one of ordinary skill in the art to modify Samar's invention according to the limitations 
recited in claim 22 using Vogel's teachings. One of ordinary skill would have been 
motivated to do so for the same reasons given in claim 1 . 
Claim 38: 

Claim 38 recites limitations substantially similar to what is recited in claim 14. 
The main difference is that claim 38 is directed towards an apparatus for implementing 
the method of claim 14. Claim 38 is rejected for the same reasons given in claim 14. 
Claims 39-45: 
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Claims 39-45 recite limitation substantially similar to what are recited in claims 
15-21 respectively and are rejected for the same reasons given in claims 15-21 
respectively. 
Claim 46: 

Claim 46 is directed towards a method implemented with the apparatus of claim 
22 and is rejected for the same reasons given in claim 22. 



Double Patenting 

Applicant is advised that should claims 3, 5, 6 be found allowable, claims 27, 29 
and 30 respectively will be objected to under 37 CFR 1.75 as being a substantial 
duplicate thereof. When two claims in an application are duplicates or else are so close 
in content that they both cover the same thing, despite a slight difference in wording, it 
is proper after allowing one claim to object to the other as being a substantial duplicate 
of the allowed claim. See MPEP § 706.03(k). 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Ponnoreay Pich whose telephone number is 571-272- 
7962. The examiner can normally be reached on 9:00am-4:30pm Mon-Fri. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on 571-272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Ponnoreay Pich 
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